Report the loss immediately and deactivate the credential if your system allows remote revocation. If you cannot deactivate it yourself, restrict access to sensitive areas straight away and call a qualified locksmith or access-control engineer. Log the incident, then confirm the old card no longer works by testing a replacement credential at the door.

TL;DR:

• Cloud-managed systems allow near-instant remote deactivation, while standalone and legacy systems often require physical reprogramming or resetting.
• Older unencrypted 125kHz cards are easier to clone than modern encrypted 13.56MHz credentials, which should influence your upgrade decisions.
• Reprogramming a credential is the fastest and cheapest fix if it can be confirmed dead, but hardware changes are necessary for systems that cannot be securely cleared.
• The response process must include immediate logging, restricted physical access, and testing a replacement credential within the first 24 hours.
• Repeated lost-card incidents or suspicions of cloning warrant a full lock change, especially in high-risk areas, to eliminate doubts about security.

Table of Contents

• Step-by-step immediate actions in the first 24 hours
• Why your access-control system type changes the response
• Replacement options and when hardware needs to change
• Building a lost-card SOP that holds up under scrutiny
• What a locksmith does after a lost access card is reported
• What facility managers should actually prioritise
• Get immediate help from ECS Locksmiths
• FAQ
• Sources

Step-by-step immediate actions in the first 24 hours

The initial hours set the tone for the whole response. Acting in order, rather than reacting piecemeal, keeps the building secure and gives you a clean record if anything is later questioned.

1. Notify your facility manager, IT or security lead, and reception within minutes of the report, so everyone watching the door knows a credential is live and unaccounted for.
2. Log the time of loss, the cardholder’s name, the areas that credential could open, and who reported it.
3. If you manage a cloud-based system, deactivate the credential from the dashboard immediately; if it is a standalone or legacy reader, call your locksmith or installer to arrange reprogramming or a shadow-card reset.
4. Apply temporary physical controls where deactivation is not instant: post a notice at reception, assign an escort for visitors, or restrict lift and door access to sensitive floors until the credential is confirmed dead.
5. Issue a replacement credential and test it at the relevant doors before closing the incident.
6. Review access logs for any use of the lost card between the time it went missing and the time it was deactivated.

Treating this as a security incident rather than an administrative task changes how fast it gets handled, and industry guidance for property managers recommends immediate deactivation, replacement and log review as the standard response.

Pro Tip: Keep a short, printed checklist by reception so whoever answers the first call knows exactly who to notify and in what order, even outside office hours.

Why your access-control system type changes the response

Not every system lets you kill a lost card in seconds. How your building manages credentials determines whether the fix takes two minutes or two hours.

• Cloud-managed systems let you revoke a credential remotely through a permissions dashboard, often within moments, which is why property-management guidance points to cloud platforms as the faster option for credential control.
• Standalone or legacy readers often need a physical shadow or master card presented at each door to void a lost credential, and without one on hand a full system reset may be the only route.
• Unencrypted 125kHz systems carry a cloning risk that encrypted alternatives do not.
• Networked but non-cloud systems usually still require someone on-site to push the deactivation through a local controller, so response time depends on who holds admin access.

Older, unencrypted proximity cards are easier to clone than modern encrypted ones, and legal and security practitioner guidance identifies this as a reason to move towards encrypted 13.56MHz credentials where cloning is a realistic concern. Check your system documentation, or ask your installer directly, whether your readers support remote revocation and what encryption your cards use before you decide how urgently to act.

Replacement options and when hardware needs to change

Not every lost card calls for the same fix. The right response depends on what the system can do and how much risk you are willing to carry.

• Reprogramming or issuing a new credential is the quickest option when the old one can be cleanly deactivated and confirmed dead on the system.
• Replacing a reader or controller becomes necessary when a standalone system cannot be securely cleared of the lost credential, which vendor incident-reporting guidance flags as a live vulnerability until it is corrected.
• A full lock or cylinder change is the last resort, reserved for high-risk areas, repeated losses, or any suspicion the card has already been cloned or used.
• Cost and time scale with the option: reprogramming is usually the fastest and cheapest, reader replacement takes longer and needs an installer visit, and a full lock change is the most disruptive but removes doubt entirely.

Simply issuing a new card without confirming the old one is dead solves nothing: the original credential stays usable until the system explicitly revokes it, so verification is not optional.

Building a lost-card SOP that holds up under scrutiny

A lost card is a security incident, not paperwork. Treating it that way protects the building and protects you if the incident is ever questioned later.

1. Record the incident with a timestamp, the cardholder’s name, the areas affected, and the action taken, then file it where it can be retrieved later.
2. Pull the access log covering the period between the loss and the deactivation, and flag any entry that does not match the cardholder’s known movements.
3. Escalate immediately if the lost card could reach a sensitive area such as a server room, plant room or cash office, or if the same person has lost a card more than once.
4. Notify affected tenants or staff once the credential is deactivated, so they know the risk has been closed.

Timely deactivation and a clear log matter beyond convenience: they are often what an insurer or a tenant’s legal team will ask to see if a dispute follows a break-in.

Pro Tip: Store incident records somewhere separate from day-to-day building logs, so you can produce a full history quickly if one is ever requested.

What a locksmith does after a lost access card is reported

Once the card is reported, a locksmith or security installer can handle the parts that need physical access: on-site deactivation and reprogramming, issuing a replacement credential, or swapping out readers and cylinders where the system cannot be cleared remotely. We test every replacement on-site before we leave, so you know the door responds correctly and the old card is confirmed dead.

To move quickly, we will ask for your system type, who holds administrator or keeper credentials, and any documentation you have on the reader or controller. For emergency call-outs we work around the clock, and electronic security work, including lost-card response, comes with a free estimate before anything is booked.

What facility managers should actually prioritise

Most lost-card incidents are not solved by faster reprogramming. They are solved by spending the budget on the right things before the next loss happens.

If you manage a building on legacy unencrypted readers, the smarter long-term spend is a move to encrypted, cloud-enabled credentials, not a faster response plan bolted onto an old system. A shadow-card workflow will always be slower and riskier than a dashboard revocation, no matter how well you train staff to use it.

Repeated losses by the same person are not bad luck, they are a sign the access policy or the credential format is not working for how people actually move through the building.

— Barry

Get immediate help from ECS Locksmiths

Once a card is reported lost, speed matters more than anything else. We handle emergency call-outs, credential reprogramming, and reader or lock replacement when a system cannot be securely cleared, with electronic security work covered under a free estimate before you commit to anything. When you contact us, have your location, your system type and whether the lost card is known to have been used ready to hand over, so we can send the right engineer with the right equipment. You can see the full range of emergency lockout and electronic security services we offer, or check local locksmith availability near you if you need someone on-site today.

FAQ

What should I do first if I lose my access card?

Report the loss to your facility manager or security contact right away and deactivate the credential if your system allows remote revocation. If it does not, restrict access to sensitive areas and arrange for a locksmith or installer to reprogram or reset the reader.

Can someone else use my lost access card before it is deactivated?

Yes, a lost card remains usable until it is explicitly deactivated on the system, which is why vendor incident guidance warns against assuming a replacement alone solves the risk. Reviewing the access log for the period before deactivation shows whether it was used.

How do I know if my access card system can be cloned?

Older 125kHz proximity systems carry a known cloning risk, while encrypted 13.56MHz credentials are significantly harder to copy, according to practitioner security guidance. Check your card and reader specification, or ask your installer, to confirm which type you have.

When does a lost card mean I need to change the locks?

A full lock or cylinder change is generally reserved for high-risk areas, suspected cloning, or systems that cannot be securely cleared of the lost credential. For most cloud-managed systems, deactivating the card and issuing a replacement is enough once the deactivation is tested and confirmed.

How much does it cost to deal with a lost access card?

Costs vary by system and whether reprogramming, a reader replacement or a full lock change is needed, so most locksmiths quote on request after seeing the setup. Emergency lockout assistance from ECS Locksmiths is priced at 85 to 120 euro one-off, with other electronic security work quoted after a free estimate.

Sources

For system-specific detail, check the documentation from your access-control manufacturer, since revocation steps differ between platforms. The guides linked throughout this article cover RFID credential security and incident response practice in more depth, including cloud key fob management and legacy credential risk.

• RFID Key Fob System: Complete Guide for Property Managers (2026) | Swiftlane
• Netwatch: incident reporting and credential management
• Practical Law: security credential considerations (legacy vs modern systems)

Recommended

• Expert Door Repair Dublin in Dardistown
• Expert Door Repair Dublin in Sandyford
• Expert Door Repair Dublin in Cabra
• Expert Door Repair Dublin in palmerstown